- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 2195/2195] include/linux/fortify-string.h:606:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()?
by kernel test robot 27 Jun '25

27 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: dd013ad487534c1838afc2f55efdb5daec15aace [2195/2195] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250627/202506270011.JbqIzVUa-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250627/202506270011.JbqIzVUa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506270011.JbqIzVUa-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.c:12: In file included from drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_ethtool.h:14: In file included from include/linux/ethtool.h:16: In file included from include/linux/bitmap.h:11: In file included from include/linux/string.h:294: >> include/linux/fortify-string.h:606:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning] 606 | __read_overflow2_field(q_size_field, size); | ^ 1 error generated. vim +606 include/linux/fortify-string.h a28a6e860c6cf2 Francis Laniel 2021-02-25 541 f68f2ff91512c1 Kees Cook 2021-04-20 542 /* f68f2ff91512c1 Kees Cook 2021-04-20 543 * To make sure the compiler can enforce protection against buffer overflows, f68f2ff91512c1 Kees Cook 2021-04-20 544 * memcpy(), memmove(), and memset() must not be used beyond individual f68f2ff91512c1 Kees Cook 2021-04-20 545 * struct members. If you need to copy across multiple members, please use f68f2ff91512c1 Kees Cook 2021-04-20 546 * struct_group() to create a named mirror of an anonymous struct union. f68f2ff91512c1 Kees Cook 2021-04-20 547 * (e.g. see struct sk_buff.) Read overflow checking is currently only f68f2ff91512c1 Kees Cook 2021-04-20 548 * done when a write overflow is also present, or when building with W=1. f68f2ff91512c1 Kees Cook 2021-04-20 549 * f68f2ff91512c1 Kees Cook 2021-04-20 550 * Mitigation coverage matrix f68f2ff91512c1 Kees Cook 2021-04-20 551 * Bounds checking at: f68f2ff91512c1 Kees Cook 2021-04-20 552 * +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 553 * | Compile time | Run time | f68f2ff91512c1 Kees Cook 2021-04-20 554 * memcpy() argument sizes: | write | read | write | read | f68f2ff91512c1 Kees Cook 2021-04-20 555 * dest source length +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 556 * memcpy(known, known, constant) | y | y | n/a | n/a | f68f2ff91512c1 Kees Cook 2021-04-20 557 * memcpy(known, unknown, constant) | y | n | n/a | V | f68f2ff91512c1 Kees Cook 2021-04-20 558 * memcpy(known, known, dynamic) | n | n | B | B | f68f2ff91512c1 Kees Cook 2021-04-20 559 * memcpy(known, unknown, dynamic) | n | n | B | V | f68f2ff91512c1 Kees Cook 2021-04-20 560 * memcpy(unknown, known, constant) | n | y | V | n/a | f68f2ff91512c1 Kees Cook 2021-04-20 561 * memcpy(unknown, unknown, constant) | n | n | V | V | f68f2ff91512c1 Kees Cook 2021-04-20 562 * memcpy(unknown, known, dynamic) | n | n | V | B | f68f2ff91512c1 Kees Cook 2021-04-20 563 * memcpy(unknown, unknown, dynamic) | n | n | V | V | f68f2ff91512c1 Kees Cook 2021-04-20 564 * +-------+-------+-------+-------+ f68f2ff91512c1 Kees Cook 2021-04-20 565 * f68f2ff91512c1 Kees Cook 2021-04-20 566 * y = perform deterministic compile-time bounds checking f68f2ff91512c1 Kees Cook 2021-04-20 567 * n = cannot perform deterministic compile-time bounds checking f68f2ff91512c1 Kees Cook 2021-04-20 568 * n/a = no run-time bounds checking needed since compile-time deterministic f68f2ff91512c1 Kees Cook 2021-04-20 569 * B = can perform run-time bounds checking (currently unimplemented) f68f2ff91512c1 Kees Cook 2021-04-20 570 * V = vulnerable to run-time overflow (will need refactoring to solve) f68f2ff91512c1 Kees Cook 2021-04-20 571 * f68f2ff91512c1 Kees Cook 2021-04-20 572 */ 54d9469bc515dc Kees Cook 2021-06-24 573 __FORTIFY_INLINE bool fortify_memcpy_chk(__kernel_size_t size, f68f2ff91512c1 Kees Cook 2021-04-20 574 const size_t p_size, f68f2ff91512c1 Kees Cook 2021-04-20 575 const size_t q_size, f68f2ff91512c1 Kees Cook 2021-04-20 576 const size_t p_size_field, f68f2ff91512c1 Kees Cook 2021-04-20 577 const size_t q_size_field, f68f2ff91512c1 Kees Cook 2021-04-20 578 const char *func) a28a6e860c6cf2 Francis Laniel 2021-02-25 579 { a28a6e860c6cf2 Francis Laniel 2021-02-25 580 if (__builtin_constant_p(size)) { f68f2ff91512c1 Kees Cook 2021-04-20 581 /* f68f2ff91512c1 Kees Cook 2021-04-20 582 * Length argument is a constant expression, so we f68f2ff91512c1 Kees Cook 2021-04-20 583 * can perform compile-time bounds checking where fa35198f39571b Kees Cook 2022-09-19 584 * buffer sizes are also known at compile time. f68f2ff91512c1 Kees Cook 2021-04-20 585 */ f68f2ff91512c1 Kees Cook 2021-04-20 586 f68f2ff91512c1 Kees Cook 2021-04-20 587 /* Error when size is larger than enclosing struct. */ fa35198f39571b Kees Cook 2022-09-19 588 if (__compiletime_lessthan(p_size_field, p_size) && fa35198f39571b Kees Cook 2022-09-19 589 __compiletime_lessthan(p_size, size)) a28a6e860c6cf2 Francis Laniel 2021-02-25 590 __write_overflow(); fa35198f39571b Kees Cook 2022-09-19 591 if (__compiletime_lessthan(q_size_field, q_size) && fa35198f39571b Kees Cook 2022-09-19 592 __compiletime_lessthan(q_size, size)) a28a6e860c6cf2 Francis Laniel 2021-02-25 593 __read_overflow2(); f68f2ff91512c1 Kees Cook 2021-04-20 594 f68f2ff91512c1 Kees Cook 2021-04-20 595 /* Warn when write size argument larger than dest field. */ fa35198f39571b Kees Cook 2022-09-19 596 if (__compiletime_lessthan(p_size_field, size)) f68f2ff91512c1 Kees Cook 2021-04-20 597 __write_overflow_field(p_size_field, size); f68f2ff91512c1 Kees Cook 2021-04-20 598 /* f68f2ff91512c1 Kees Cook 2021-04-20 599 * Warn for source field over-read when building with W=1 f68f2ff91512c1 Kees Cook 2021-04-20 600 * or when an over-write happened, so both can be fixed at f68f2ff91512c1 Kees Cook 2021-04-20 601 * the same time. f68f2ff91512c1 Kees Cook 2021-04-20 602 */ fa35198f39571b Kees Cook 2022-09-19 603 if ((IS_ENABLED(KBUILD_EXTRA_WARN1) || fa35198f39571b Kees Cook 2022-09-19 604 __compiletime_lessthan(p_size_field, size)) && fa35198f39571b Kees Cook 2022-09-19 605 __compiletime_lessthan(q_size_field, size)) f68f2ff91512c1 Kees Cook 2021-04-20 @606 __read_overflow2_field(q_size_field, size); a28a6e860c6cf2 Francis Laniel 2021-02-25 607 } f68f2ff91512c1 Kees Cook 2021-04-20 608 /* f68f2ff91512c1 Kees Cook 2021-04-20 609 * At this point, length argument may not be a constant expression, f68f2ff91512c1 Kees Cook 2021-04-20 610 * so run-time bounds checking can be done where buffer sizes are f68f2ff91512c1 Kees Cook 2021-04-20 611 * known. (This is not an "else" because the above checks may only f68f2ff91512c1 Kees Cook 2021-04-20 612 * be compile-time warnings, and we want to still warn for run-time f68f2ff91512c1 Kees Cook 2021-04-20 613 * overflows.) f68f2ff91512c1 Kees Cook 2021-04-20 614 */ f68f2ff91512c1 Kees Cook 2021-04-20 615 f68f2ff91512c1 Kees Cook 2021-04-20 616 /* f68f2ff91512c1 Kees Cook 2021-04-20 617 * Always stop accesses beyond the struct that contains the f68f2ff91512c1 Kees Cook 2021-04-20 618 * field, when the buffer's remaining size is known. 311fb40aa0569a Kees Cook 2022-09-02 619 * (The SIZE_MAX test is to optimize away checks where the buffer f68f2ff91512c1 Kees Cook 2021-04-20 620 * lengths are unknown.) f68f2ff91512c1 Kees Cook 2021-04-20 621 */ 311fb40aa0569a Kees Cook 2022-09-02 622 if ((p_size != SIZE_MAX && p_size < size) || 311fb40aa0569a Kees Cook 2022-09-02 623 (q_size != SIZE_MAX && q_size < size)) f68f2ff91512c1 Kees Cook 2021-04-20 624 fortify_panic(func); 54d9469bc515dc Kees Cook 2021-06-24 625 54d9469bc515dc Kees Cook 2021-06-24 626 /* 54d9469bc515dc Kees Cook 2021-06-24 627 * Warn when writing beyond destination field size. 54d9469bc515dc Kees Cook 2021-06-24 628 * 54d9469bc515dc Kees Cook 2021-06-24 629 * We must ignore p_size_field == 0 for existing 0-element 54d9469bc515dc Kees Cook 2021-06-24 630 * fake flexible arrays, until they are all converted to 54d9469bc515dc Kees Cook 2021-06-24 631 * proper flexible arrays. 54d9469bc515dc Kees Cook 2021-06-24 632 * 9f7d69c5cd2390 Kees Cook 2022-09-19 633 * The implementation of __builtin_*object_size() behaves 54d9469bc515dc Kees Cook 2021-06-24 634 * like sizeof() when not directly referencing a flexible 54d9469bc515dc Kees Cook 2021-06-24 635 * array member, which means there will be many bounds checks 54d9469bc515dc Kees Cook 2021-06-24 636 * that will appear at run-time, without a way for them to be 54d9469bc515dc Kees Cook 2021-06-24 637 * detected at compile-time (as can be done when the destination 54d9469bc515dc Kees Cook 2021-06-24 638 * is specifically the flexible array member). 54d9469bc515dc Kees Cook 2021-06-24 639 * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832 54d9469bc515dc Kees Cook 2021-06-24 640 */ 54d9469bc515dc Kees Cook 2021-06-24 641 if (p_size_field != 0 && p_size_field != SIZE_MAX && 54d9469bc515dc Kees Cook 2021-06-24 642 p_size != p_size_field && p_size_field < size) 54d9469bc515dc Kees Cook 2021-06-24 643 return true; 54d9469bc515dc Kees Cook 2021-06-24 644 54d9469bc515dc Kees Cook 2021-06-24 645 return false; a28a6e860c6cf2 Francis Laniel 2021-02-25 646 } a28a6e860c6cf2 Francis Laniel 2021-02-25 647 :::::: The code at line 606 was first introduced by commit :::::: f68f2ff91512c199ec24883001245912afc17873 fortify: Detect struct member overflows in memcpy() at compile-time :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] PM: hibernate: defer device probing when resuming from hibernation
by Zeng Heng 26 Jun '25

26 Jun '25

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v4.19.256 commit 5a283b59bce72c05c60e9f0fa92a28b5b850d8bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BR4 CVE: CVE-2022-50202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------------------------------- syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0. When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed. There are three cases that can prevent probe_count from dropping to 0. (a) A device being probed stopped responding (i.e. broken/malicious hardware). (b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason. (c) New device probe requests keeps coming in before existing device probe requests complete. The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called from hub_event() work function is waiting for the processes which are blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface. This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()). Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface. Link: https://syzkaller.appspot.com/bug?extid=358c9ab4c93da7b7238c [1] Reported-by: syzbot <syzbot+358c9ab4c93da7b7238c(a)syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Tested-by: syzbot <syzbot+358c9ab4c93da7b7238c(a)syzkaller.appspotmail.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: kernel/power/user.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- kernel/power/user.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/kernel/power/user.c b/kernel/power/user.c index 2d8b60a3c86b..6a11154b3d52 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -29,6 +29,7 @@ #include "power.h" +static bool need_wait; #define SNAPSHOT_MINOR 231 @@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp) * Resuming. We may need to wait for the image device to * appear. */ - wait_for_device_probe(); + need_wait = true; data->swap = -1; data->mode = O_WRONLY; @@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, ssize_t res; loff_t pg_offp = *offp & ~PAGE_MASK; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + lock_system_sleep(); data = filp->private_data; @@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, loff_t size; sector_t offset; + if (need_wait) { + wait_for_device_probe(); + need_wait = false; + } + if (_IOC_TYPE(cmd) != SNAPSHOT_IOC_MAGIC) return -ENOTTY; if (_IOC_NR(cmd) > SNAPSHOT_IOC_MAXNR) -- 2.25.1

2 1

[PATCH OLK-5.10] fbdev: fbcon: Properly revert changes when vc_resize() failed
by Zeng Heng 26 Jun '25

26 Jun '25

From: Shigeru Yoshida <syoshida(a)redhat.com> mainline inclusion from mainline-v6.0-rc3 commit a5a923038d70d2d4a86cb4e3f32625a5ee6e7e24 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E448 CVE: CVE-2024-26798 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- fbcon_do_set_font() calls vc_resize() when font size is changed. However, if if vc_resize() failed, current implementation doesn't revert changes for font size, and this causes inconsistent state. syzbot reported unable to handle page fault due to this issue [1]. syzbot's repro uses fault injection which cause failure for memory allocation, so vc_resize() failed. This patch fixes this issue by properly revert changes for font related date when vc_resize() failed. Link: https://syzkaller.appspot.com/bug?id=3443d3a1fa6d964dd7310a0cb1696d165a3e07… [1] Reported-by: syzbot+a168dbeaaa7778273c1b(a)syzkaller.appspotmail.com Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Signed-off-by: Helge Deller <deller(a)gmx.de> CC: stable(a)vger.kernel.org # 5.15+ Conflicts: drivers/video/fbdev/core/fbcon.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 59 ++++++++++++++++++++++---------- 1 file changed, 41 insertions(+), 18 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 6d58c8a5cb44..f0eacf1968d8 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -26,7 +26,7 @@ * * Hardware cursor support added by Emmanuel Marty (core(a)ggi-project.org) * Smart redraw scrolling, arbitrary font width support, 512char font support - * and software scrollback added by + * and software scrollback added by * Jakub Jelinek (jj(a)ultra.linux.cz) * * Random hacking by Martin Mares <mj(a)ucw.cz> @@ -125,7 +125,7 @@ static int logo_shown = FBCON_LOGO_CANSHOW; /* console mappings */ static unsigned int first_fb_vc; static unsigned int last_fb_vc = MAX_NR_CONSOLES - 1; -static int fbcon_is_default = 1; +static int fbcon_is_default = 1; static int primary_device = -1; static int fbcon_has_console_bind; @@ -447,12 +447,12 @@ static int __init fb_console_setup(char *this_opt) strlcpy(fontname, options + 5, sizeof(fontname)); continue; } - + if (!strncmp(options, "scrollback:", 11)) { pr_warn("Ignoring scrollback size option\n"); continue; } - + if (!strncmp(options, "map:", 4)) { options += 4; if (*options) { @@ -478,7 +478,7 @@ static int __init fb_console_setup(char *this_opt) last_fb_vc = simple_strtoul(options, &options, 10) - 1; if (last_fb_vc < first_fb_vc || last_fb_vc >= MAX_NR_CONSOLES) last_fb_vc = MAX_NR_CONSOLES - 1; - fbcon_is_default = 0; + fbcon_is_default = 0; continue; } @@ -966,7 +966,7 @@ static const char *fbcon_startup(void) info = registered_fb[info_idx]; if (!info) return NULL; - + owner = info->fbops->owner; if (!try_module_get(owner)) return NULL; @@ -1429,7 +1429,7 @@ static __inline__ void ywrap_up(struct vc_data *vc, int count) struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; struct fbcon_ops *ops = info->fbcon_par; struct fbcon_display *p = &fb_display[vc->vc_num]; - + p->yscroll += count; if (p->yscroll >= p->vrows) /* Deal with wrap */ p->yscroll -= p->vrows; @@ -1448,7 +1448,7 @@ static __inline__ void ywrap_down(struct vc_data *vc, int count) struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; struct fbcon_ops *ops = info->fbcon_par; struct fbcon_display *p = &fb_display[vc->vc_num]; - + p->yscroll -= count; if (p->yscroll < 0) /* Deal with wrap */ p->yscroll += p->vrows; @@ -1515,7 +1515,7 @@ static __inline__ void ypan_down(struct vc_data *vc, int count) struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; struct fbcon_display *p = &fb_display[vc->vc_num]; struct fbcon_ops *ops = info->fbcon_par; - + p->yscroll -= count; if (p->yscroll < 0) { ops->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows, @@ -1898,7 +1898,7 @@ static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx, { struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; struct fbcon_display *p = &fb_display[vc->vc_num]; - + if (fbcon_is_inactive(vc, info)) return; @@ -2023,7 +2023,7 @@ static void updatescrollmode(struct fbcon_display *p, #define PITCH(w) (((w) + 7) >> 3) #define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */ -static int fbcon_resize(struct vc_data *vc, unsigned int width, +static int fbcon_resize(struct vc_data *vc, unsigned int width, unsigned int height, unsigned int user) { struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; @@ -2201,7 +2201,7 @@ static int fbcon_switch(struct vc_data *vc) ops->update_start(info); } - fbcon_set_palette(vc, color_table); + fbcon_set_palette(vc, color_table); fbcon_clear_margins(vc, 0); if (logo_shown == FBCON_LOGO_DRAW) { @@ -2371,7 +2371,7 @@ static void set_vc_hi_font(struct vc_data *vc, bool set) vc->vc_complement_mask >>= 1; vc->vc_s_complement_mask >>= 1; } - + /* ++Edmund: reorder the attribute bits */ if (vc->vc_can_do_color) { unsigned short *cp = @@ -2394,7 +2394,7 @@ static void set_vc_hi_font(struct vc_data *vc, bool set) vc->vc_complement_mask <<= 1; vc->vc_s_complement_mask <<= 1; } - + /* ++Edmund: reorder the attribute bits */ { unsigned short *cp = @@ -2429,7 +2429,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; struct fbcon_ops *ops = info->fbcon_par; struct fbcon_display *p = &fb_display[vc->vc_num]; - int resize; + int resize, ret, old_userfont, old_width, old_height, old_charcount; int cnt; char *old_data = NULL; @@ -2441,8 +2441,14 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, else cnt = 256; vc->vc_font.data = (void *)(p->fontdata = data); + old_userfont = p->userfont; if ((p->userfont = userfont)) REFCOUNT(data)++; + + old_width = vc->vc_font.width; + old_height = vc->vc_font.height; + old_charcount = vc->vc_font.charcount; + vc->vc_font.width = w; vc->vc_font.height = h; if (vc->vc_hi_font_mask && cnt == 256) @@ -2457,7 +2463,9 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= w; rows /= h; - vc_resize(vc, cols, rows); + ret = vc_resize(vc, cols, rows); + if (ret) + goto err_out; } else if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) { fbcon_clear_margins(vc, 0); @@ -2467,6 +2475,21 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, if (old_data && (--REFCOUNT(old_data) == 0)) kfree(old_data - FONT_EXTRA_WORDS * sizeof(int)); return 0; + +err_out: + p->fontdata = old_data; + vc->vc_font.data = (void *)old_data; + + if (userfont) { + p->userfont = old_userfont; + REFCOUNT(data)--; + } + + vc->vc_font.width = old_width; + vc->vc_font.height = old_height; + vc->vc_font.charcount = old_charcount; + + return ret; } static int fbcon_copy_font(struct vc_data *vc, int con) @@ -2548,7 +2571,7 @@ static int fbcon_set_font(struct vc_data *vc, struct console_font *font, /* Check if the same font is on some other console already */ for (i = first_fb_vc; i <= last_fb_vc; i++) { struct vc_data *tmp = vc_cons[i].d; - + if (fb_display[i].userfont && fb_display[i].fontdata && FNTSUM(fb_display[i].fontdata) == csum && @@ -3485,5 +3508,5 @@ void __exit fb_console_exit(void) fbcon_exit(); do_unregister_con_driver(&fb_con); console_unlock(); -} +} #endif -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ARM: OMAP2+: display: Fix refcount leak bug
by Huang Xiaojia 26 Jun '25

26 Jun '25

From: Liang He <windhl(a)126.com> stable inclusion from stable-v4.19.256 commit 0b4f96b47ff8dc2fa35d03c4116927248796d9af category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9OT CVE: CVE-2022-50203 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50b87a32a79bca6e275918a711fb8cc55e16d739 ] In omapdss_init_fbdev(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore. Signed-off-by: Liang He <windhl(a)126.com> Message-Id: <20220617145803.4050918-1-windhl(a)126.com> Signed-off-by: Tony Lindgren <tony(a)atomide.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/arm/mach-omap2/display.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-omap2/display.c b/arch/arm/mach-omap2/display.c index 5d73f2c0b117..dd2ff10790ab 100644 --- a/arch/arm/mach-omap2/display.c +++ b/arch/arm/mach-omap2/display.c @@ -211,6 +211,7 @@ static int __init omapdss_init_fbdev(void) node = of_find_node_by_name(NULL, "omap4_padconf_global"); if (node) omap4_dsi_mux_syscon = syscon_node_to_regmap(node); + of_node_put(node); return 0; } -- 2.34.1

2 1

[openeuler:OLK-6.6 2195/2195] net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: abe6bde15def9470fe18af30626e62d51f651dd9 [2195/2195] net: tcp: Modify codes for better compatibility of code format config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261849.UT7jUs6l-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261849.UT7jUs6l-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261849.UT7jUs6l-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from net/ipv4/tcp_output.c:40: In file included from include/net/tcp.h:20: In file included from include/linux/tcp.h:17: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/x86/include/asm/cacheflush.h:5: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ net/ipv4/tcp_output.c:186:3: warning: result of comparison of constant -1 with expression of type 'u8' (aka 'unsigned char') is always false [-Wtautological-constant-out-of-range-compare] 186 | NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPACKCOMPRESSED, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 187 | tp->compressed_ack); | ~~~~~~~~~~~~~~~~~~~ include/net/ip.h:302:41: note: expanded from macro 'NET_ADD_STATS' 302 | #define NET_ADD_STATS(net, field, adnd) SNMP_ADD_STATS((net)->mib.net_statistics, field, adnd) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/net/snmp.h:143:4: note: expanded from macro 'SNMP_ADD_STATS' 143 | this_cpu_add(mib->mibs[field], addend) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/percpu-defs.h:491:33: note: expanded from macro 'this_cpu_add' 491 | #define this_cpu_add(pcp, val) __pcpu_size_call(this_cpu_add_, pcp, val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ note: (skipping 1 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all) <scratch space>:114:1: note: expanded from here 114 | this_cpu_add_8 | ^ arch/x86/include/asm/percpu.h:370:35: note: expanded from macro 'this_cpu_add_8' 370 | #define this_cpu_add_8(pcp, val) percpu_add_op(8, volatile, (pcp), val) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/include/asm/percpu.h:127:31: note: expanded from macro 'percpu_add_op' 127 | ((val) == 1 || (val) == -1)) ? \ | ~~~~~ ^ ~~ >> net/ipv4/tcp_output.c:1312:5: warning: variable 'tcp_hdr_rsrvd_4b' set but not used [-Wunused-but-set-variable] 1312 | u8 tcp_hdr_rsrvd_4b; | ^ 3 warnings generated. vim +/tcp_hdr_rsrvd_4b +1312 net/ipv4/tcp_output.c 1286 1287 /* This routine actually transmits TCP packets queued in by 1288 * tcp_do_sendmsg(). This is used by both the initial 1289 * transmission and possible later retransmissions. 1290 * All SKB's seen here are completely headerless. It is our 1291 * job to build the TCP header, and pass the packet down to 1292 * IP so it can do the same plus pass the packet off to the 1293 * device. 1294 * 1295 * We are working here with either a clone of the original 1296 * SKB, or a fresh unique copy made by the retransmit engine. 1297 */ 1298 static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, 1299 int clone_it, gfp_t gfp_mask, u32 rcv_nxt) 1300 { 1301 const struct inet_connection_sock *icsk = inet_csk(sk); 1302 struct inet_sock *inet; 1303 struct tcp_sock *tp; 1304 struct tcp_skb_cb *tcb; 1305 struct tcp_out_options opts; 1306 unsigned int tcp_options_size, tcp_header_size; 1307 struct sk_buff *oskb = NULL; 1308 struct tcp_md5sig_key *md5; 1309 struct tcphdr *th; 1310 u64 prior_wstamp; 1311 int err; > 1312 u8 tcp_hdr_rsrvd_4b; 1313 1314 BUG_ON(!skb || !tcp_skb_pcount(skb)); 1315 tcp_hdr_rsrvd_4b = try_to_update_skb_for_caqm(sk, skb); 1316 tp = tcp_sk(sk); 1317 prior_wstamp = tp->tcp_wstamp_ns; 1318 tp->tcp_wstamp_ns = max(tp->tcp_wstamp_ns, tp->tcp_clock_cache); 1319 skb_set_delivery_time(skb, tp->tcp_wstamp_ns, true); 1320 if (clone_it) { 1321 oskb = skb; 1322 1323 tcp_skb_tsorted_save(oskb) { 1324 if (unlikely(skb_cloned(oskb))) 1325 skb = pskb_copy(oskb, gfp_mask); 1326 else 1327 skb = skb_clone(oskb, gfp_mask); 1328 } tcp_skb_tsorted_restore(oskb); 1329 1330 if (unlikely(!skb)) 1331 return -ENOBUFS; 1332 /* retransmit skbs might have a non zero value in skb->dev 1333 * because skb->dev is aliased with skb->rbnode.rb_left 1334 */ 1335 skb->dev = NULL; 1336 } 1337 1338 inet = inet_sk(sk); 1339 tcb = TCP_SKB_CB(skb); 1340 memset(&opts, 0, sizeof(opts)); 1341 1342 if (unlikely(tcb->tcp_flags & TCPHDR_SYN)) { 1343 tcp_options_size = tcp_syn_options(sk, skb, &opts, &md5); 1344 } else { 1345 tcp_options_size = tcp_established_options(sk, skb, &opts, 1346 &md5); 1347 /* Force a PSH flag on all (GSO) packets to expedite GRO flush 1348 * at receiver : This slightly improve GRO performance. 1349 * Note that we do not force the PSH flag for non GSO packets, 1350 * because they might be sent under high congestion events, 1351 * and in this case it is better to delay the delivery of 1-MSS 1352 * packets and thus the corresponding ACK packet that would 1353 * release the following packet. 1354 */ 1355 if (tcp_skb_pcount(skb) > 1) 1356 tcb->tcp_flags |= TCPHDR_PSH; 1357 } 1358 tcp_header_size = tcp_options_size + sizeof(struct tcphdr); 1359 1360 /* We set skb->ooo_okay to one if this packet can select 1361 * a different TX queue than prior packets of this flow, 1362 * to avoid self inflicted reorders. 1363 * The 'other' queue decision is based on current cpu number 1364 * if XPS is enabled, or sk->sk_txhash otherwise. 1365 * We can switch to another (and better) queue if: 1366 * 1) No packet with payload is in qdisc/device queues. 1367 * Delays in TX completion can defeat the test 1368 * even if packets were already sent. 1369 * 2) Or rtx queue is empty. 1370 * This mitigates above case if ACK packets for 1371 * all prior packets were already processed. 1372 */ 1373 skb->ooo_okay = sk_wmem_alloc_get(sk) < SKB_TRUESIZE(1) || 1374 tcp_rtx_queue_empty(sk); 1375 1376 /* If we had to use memory reserve to allocate this skb, 1377 * this might cause drops if packet is looped back : 1378 * Other socket might not have SOCK_MEMALLOC. 1379 * Packets not looped back do not care about pfmemalloc. 1380 */ 1381 skb->pfmemalloc = 0; 1382 1383 skb_push(skb, tcp_header_size); 1384 skb_reset_transport_header(skb); 1385 1386 skb_orphan(skb); 1387 skb->sk = sk; 1388 skb->destructor = skb_is_tcp_pure_ack(skb) ? __sock_wfree : tcp_wfree; 1389 refcount_add(skb->truesize, &sk->sk_wmem_alloc); 1390 1391 skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm)); 1392 1393 /* Build TCP header and checksum it. */ 1394 th = (struct tcphdr *)skb->data; 1395 th->source = inet->inet_sport; 1396 th->dest = inet->inet_dport; 1397 th->seq = htonl(tcb->seq); 1398 th->ack_seq = htonl(rcv_nxt); 1399 *(((__be16 *)th) + 6) = htons(((tcp_header_size >> 2) << 12) | 1400 tcb->tcp_flags); 1401 #ifdef CONFIG_ETH_CAQM 1402 if (static_branch_unlikely(&sysctl_caqm_enable)) 1403 *(((__be16 *)th) + 6) |= htons((tcp_hdr_rsrvd_4b & 0x0F) << 8); 1404 #endif 1405 1406 th->check = 0; 1407 th->urg_ptr = 0; 1408 1409 /* The urg_mode check is necessary during a below snd_una win probe */ 1410 if (unlikely(tcp_urg_mode(tp) && before(tcb->seq, tp->snd_up))) { 1411 if (before(tp->snd_up, tcb->seq + 0x10000)) { 1412 th->urg_ptr = htons(tp->snd_up - tcb->seq); 1413 th->urg = 1; 1414 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) { 1415 th->urg_ptr = htons(0xFFFF); 1416 th->urg = 1; 1417 } 1418 } 1419 1420 skb_shinfo(skb)->gso_type = sk->sk_gso_type; 1421 if (likely(!(tcb->tcp_flags & TCPHDR_SYN))) { 1422 th->window = htons(tcp_select_window(sk)); 1423 tcp_ecn_send(sk, skb, th, tcp_header_size); 1424 } else { 1425 /* RFC1323: The window in SYN & SYN/ACK segments 1426 * is never scaled. 1427 */ 1428 th->window = htons(min(tp->rcv_wnd, 65535U)); 1429 } 1430 1431 tcp_options_write(th, tp, &opts); 1432 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: 3bfa35ccde9e52ca74fed047eb4d89be32dd9e5e [2195/2195] mm/numa: no task_numa_fault() call if PTE is changed config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261637.qYfRPb91-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261637.qYfRPb91-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261637.qYfRPb91-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/memory.c:43: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from mm/memory.c:44: include/linux/mm_inline.h:47:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 47 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:49:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 49 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ >> mm/memory.c:5277:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5277 | int flags = 0, nr_pages; | ^ 4 warnings generated. vim +/nr_pages +5277 mm/memory.c f569661eacc258 Baolin Wang 2024-05-11 5266 2b7403035459c7 Souptick Joarder 2018-08-23 5267 static vm_fault_t do_numa_page(struct vm_fault *vmf) d10e63f29488b0 Mel Gorman 2012-10-25 5268 { 82b0f8c39a3869 Jan Kara 2016-12-14 5269 struct vm_area_struct *vma = vmf->vma; d5e6c8d5790088 Kefeng Wang 2023-11-27 5270 struct folio *folio = NULL; d5e6c8d5790088 Kefeng Wang 2023-11-27 5271 int nid = NUMA_NO_NODE; 2cb37064a2b82c Baolin Wang 2024-06-22 5272 bool writable = false, ignore_writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5273 bool pte_write_upgrade = vma_wants_manual_pte_write_upgrade(vma); 90572890d20252 Peter Zijlstra 2013-10-07 5274 int last_cpupid; cbee9f88ec1b8d Peter Zijlstra 2012-10-25 5275 int target_nid; 04a8645304500b Aneesh Kumar K.V 2019-03-05 5276 pte_t pte, old_pte; 2cb37064a2b82c Baolin Wang 2024-06-22 @5277 int flags = 0, nr_pages; d10e63f29488b0 Mel Gorman 2012-10-25 5278 d10e63f29488b0 Mel Gorman 2012-10-25 5279 /* e2491c31fb10ae John Hubbard 2024-05-25 5280 * The pte cannot be used safely until we verify, while holding the page e2491c31fb10ae John Hubbard 2024-05-25 5281 * table lock, that its contents have not changed during fault handling. d10e63f29488b0 Mel Gorman 2012-10-25 5282 */ 82b0f8c39a3869 Jan Kara 2016-12-14 5283 spin_lock(vmf->ptl); e2491c31fb10ae John Hubbard 2024-05-25 5284 /* Read the live PTE from the page tables: */ e2491c31fb10ae John Hubbard 2024-05-25 5285 old_pte = ptep_get(vmf->pte); e2491c31fb10ae John Hubbard 2024-05-25 5286 e2491c31fb10ae John Hubbard 2024-05-25 5287 if (unlikely(!pte_same(old_pte, vmf->orig_pte))) { 82b0f8c39a3869 Jan Kara 2016-12-14 5288 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5289 return 0; 4daae3b4b9e49b Mel Gorman 2012-11-02 5290 } 4daae3b4b9e49b Mel Gorman 2012-11-02 5291 04a8645304500b Aneesh Kumar K.V 2019-03-05 5292 pte = pte_modify(old_pte, vma->vm_page_prot); d10e63f29488b0 Mel Gorman 2012-10-25 5293 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5294 /* 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5295 * Detect now whether the PTE could be writable; this information 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5296 * is only valid while holding the PT lock. 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5297 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5298 writable = pte_write(pte); 2cb37064a2b82c Baolin Wang 2024-06-22 5299 if (!writable && pte_write_upgrade && 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5300 can_change_pte_writable(vma, vmf->address, pte)) 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5301 writable = true; 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5302 d5e6c8d5790088 Kefeng Wang 2023-11-27 5303 folio = vm_normal_folio(vma, vmf->address, pte); d5e6c8d5790088 Kefeng Wang 2023-11-27 5304 if (!folio || folio_is_zone_device(folio)) b99a342d4f11a5 Huang Ying 2021-04-29 5305 goto out_map; d10e63f29488b0 Mel Gorman 2012-10-25 5306 6688cc05473b36 Peter Zijlstra 2013-10-07 5307 /* bea66fbd11af1c Mel Gorman 2015-03-25 5308 * Avoid grouping on RO pages in general. RO pages shouldn't hurt as bea66fbd11af1c Mel Gorman 2015-03-25 5309 * much anyway since they can be in shared cache state. This misses bea66fbd11af1c Mel Gorman 2015-03-25 5310 * the case where a mapping is writable but the process never writes bea66fbd11af1c Mel Gorman 2015-03-25 5311 * to it but pte_write gets cleared during protection updates and bea66fbd11af1c Mel Gorman 2015-03-25 5312 * pte_dirty has unpredictable behaviour between PTE scan updates, bea66fbd11af1c Mel Gorman 2015-03-25 5313 * background writeback, dirty balancing and application behaviour. bea66fbd11af1c Mel Gorman 2015-03-25 5314 */ 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5315 if (!writable) 6688cc05473b36 Peter Zijlstra 2013-10-07 5316 flags |= TNF_NO_GROUP; 6688cc05473b36 Peter Zijlstra 2013-10-07 5317 dabe1d992414a6 Rik van Riel 2013-10-07 5318 /* d5e6c8d5790088 Kefeng Wang 2023-11-27 5319 * Flag if the folio is shared between multiple address spaces. This dabe1d992414a6 Rik van Riel 2013-10-07 5320 * is later used when determining whether to group tasks together dabe1d992414a6 Rik van Riel 2013-10-07 5321 */ b8eba2d7e4a309 David Hildenbrand 2024-05-11 5322 if (folio_likely_mapped_shared(folio) && (vma->vm_flags & VM_SHARED)) dabe1d992414a6 Rik van Riel 2013-10-07 5323 flags |= TNF_SHARED; dabe1d992414a6 Rik van Riel 2013-10-07 5324 d5e6c8d5790088 Kefeng Wang 2023-11-27 5325 nid = folio_nid(folio); 2cb37064a2b82c Baolin Wang 2024-06-22 5326 nr_pages = folio_nr_pages(folio); 33024536bafd91 Huang Ying 2022-07-13 5327 /* 33024536bafd91 Huang Ying 2022-07-13 5328 * For memory tiering mode, cpupid of slow memory page is used 33024536bafd91 Huang Ying 2022-07-13 5329 * to record page access time. So use default value. 33024536bafd91 Huang Ying 2022-07-13 5330 */ 33024536bafd91 Huang Ying 2022-07-13 5331 if ((sysctl_numa_balancing_mode & NUMA_BALANCING_MEMORY_TIERING) && d5e6c8d5790088 Kefeng Wang 2023-11-27 5332 !node_is_toptier(nid)) 33024536bafd91 Huang Ying 2022-07-13 5333 last_cpupid = (-1 & LAST_CPUPID_MASK); 33024536bafd91 Huang Ying 2022-07-13 5334 else 28e1ec746768bb Kefeng Wang 2023-11-27 5335 last_cpupid = folio_last_cpupid(folio); bf7c2ab764599b Kefeng Wang 2023-11-27 5336 target_nid = numa_migrate_prep(folio, vma, vmf->address, nid, &flags); 98fa15f34cb379 Anshuman Khandual 2019-03-05 5337 if (target_nid == NUMA_NO_NODE) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5338 folio_put(folio); b99a342d4f11a5 Huang Ying 2021-04-29 5339 goto out_map; 4daae3b4b9e49b Mel Gorman 2012-11-02 5340 } b99a342d4f11a5 Huang Ying 2021-04-29 5341 pte_unmap_unlock(vmf->pte, vmf->ptl); 6a56ccbcf6c695 David Hildenbrand 2022-11-08 5342 writable = false; 2cb37064a2b82c Baolin Wang 2024-06-22 5343 ignore_writable = true; 4daae3b4b9e49b Mel Gorman 2012-11-02 5344 4daae3b4b9e49b Mel Gorman 2012-11-02 5345 /* Migrate to the requested node */ d5e6c8d5790088 Kefeng Wang 2023-11-27 5346 if (migrate_misplaced_folio(folio, vma, target_nid)) { d5e6c8d5790088 Kefeng Wang 2023-11-27 5347 nid = target_nid; 6688cc05473b36 Peter Zijlstra 2013-10-07 5348 flags |= TNF_MIGRATED; 3bfa35ccde9e52 Zi Yan 2024-08-09 5349 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5350 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5351 } 3bfa35ccde9e52 Zi Yan 2024-08-09 5352 074c238177a75f Mel Gorman 2015-03-25 5353 flags |= TNF_MIGRATE_FAIL; c7ad08804fae5b Hugh Dickins 2023-06-08 5354 vmf->pte = pte_offset_map_lock(vma->vm_mm, vmf->pmd, c7ad08804fae5b Hugh Dickins 2023-06-08 5355 vmf->address, &vmf->ptl); c7ad08804fae5b Hugh Dickins 2023-06-08 5356 if (unlikely(!vmf->pte)) 3bfa35ccde9e52 Zi Yan 2024-08-09 5357 return 0; c33c794828f212 Ryan Roberts 2023-06-12 5358 if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) { b99a342d4f11a5 Huang Ying 2021-04-29 5359 pte_unmap_unlock(vmf->pte, vmf->ptl); d10e63f29488b0 Mel Gorman 2012-10-25 5360 return 0; 3bfa35ccde9e52 Zi Yan 2024-08-09 5361 } b99a342d4f11a5 Huang Ying 2021-04-29 5362 out_map: b99a342d4f11a5 Huang Ying 2021-04-29 5363 /* b99a342d4f11a5 Huang Ying 2021-04-29 5364 * Make it present again, depending on how arch implements b99a342d4f11a5 Huang Ying 2021-04-29 5365 * non-accessible ptes, some can allow access by kernel mode. b99a342d4f11a5 Huang Ying 2021-04-29 5366 */ 2cb37064a2b82c Baolin Wang 2024-06-22 5367 if (folio && folio_test_large(folio)) 2cb37064a2b82c Baolin Wang 2024-06-22 5368 numa_rebuild_large_mapping(vmf, vma, folio, pte, ignore_writable, 2cb37064a2b82c Baolin Wang 2024-06-22 5369 pte_write_upgrade); 2cb37064a2b82c Baolin Wang 2024-06-22 5370 else 2cb37064a2b82c Baolin Wang 2024-06-22 5371 numa_rebuild_single_mapping(vmf, vma, vmf->address, vmf->pte, 2cb37064a2b82c Baolin Wang 2024-06-22 5372 writable); b99a342d4f11a5 Huang Ying 2021-04-29 5373 pte_unmap_unlock(vmf->pte, vmf->ptl); 3bfa35ccde9e52 Zi Yan 2024-08-09 5374 3bfa35ccde9e52 Zi Yan 2024-08-09 5375 if (nid != NUMA_NO_NODE) 3bfa35ccde9e52 Zi Yan 2024-08-09 5376 task_numa_fault(last_cpupid, nid, 1, flags); 3bfa35ccde9e52 Zi Yan 2024-08-09 5377 return 0; d10e63f29488b0 Mel Gorman 2012-10-25 5378 } d10e63f29488b0 Mel Gorman 2012-10-25 5379 :::::: The code at line 5277 was first introduced by commit :::::: 2cb37064a2b82cd8ebeeaaed21259b5912dff51d mm: support multi-size THP numa balancing :::::: TO: Baolin Wang <baolin.wang(a)linux.alibaba.com> :::::: CC: Liu Shixin <liushixin2(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-50080
by Yuntao Liu 26 Jun '25

26 Jun '25

CVE-2022-50080 Jens Wiklander (2): tee: add overflow check in register_shm_helper() tee: fix compiler warning in tee_shm_register() drivers/tee/tee_core.c | 4 ++++ drivers/tee/tee_shm.c | 1 + 2 files changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 26 Jun '25

26 Jun '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> stable inclusion from stable-v6.6.93 commit ca85c2d0db5f8309832be45858b960d933c2131c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEC CVE: CVE-2025-38074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [Since this fix just want to protect vhost_add_used function from conccurent situation. And vhost_scsi_virtqueue data structure is different so we cannot get the virt queue from vhost_work. In this version, get the virt queue from cmd and solve the conccurent situation.] Signed-off-by: Zheng Xinyu <zhengxinyu6(a)huawei.com> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index a5c6f0baedda..da38525d2e60 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); if (likely(ret == sizeof(v_rsp))) { struct vhost_scsi_virtqueue *q; - vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); + mutex_lock(&q->vq.mutex); + vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + mutex_unlock(&q->vq.mutex); vq = q - vs->vqs; __set_bit(vq, signal); } else @@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) else resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

2 1

[openeuler:OLK-6.6 2195/2195] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:299:21: warning: variable 'netdev' set but not used
by kernel test robot 26 Jun '25

26 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: c02455c4cce8052f74fc11c09e9073c01c7f33a4 commit: 2d861e6888256771288076b36aa9beba46c7af67 [2195/2195] Net: nebula_matrix: fix ci compile nbl_ethtool.c warning config: x86_64-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250626/202506261533.YYy68pzU-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506261533.YYy68pzU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506261533.YYy68pzU-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:7: In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.h:10: In file included from drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_service.h:10: In file included from include/linux/mm.h:2247: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:299:21: warning: variable 'netdev' set but not used [-Wunused-but-set-variable] 299 | struct net_device *netdev; | ^ >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:1666:36: warning: variable 'net_resource_mgt' set but not used [-Wunused-but-set-variable] 1666 | struct nbl_serv_net_resource_mgt *net_resource_mgt; | ^ 3 warnings generated. vim +/netdev +299 drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c bad535d287c9c1 Bennie Yan 2024-09-24 293 2d861e68882567 Bennie Yan 2024-11-19 294 static void nbl_serv_adjust_interrpt_param(struct nbl_service_mgt *serv_mgt, bool ethtool) bad535d287c9c1 Bennie Yan 2024-09-24 295 { bad535d287c9c1 Bennie Yan 2024-09-24 296 struct nbl_serv_net_resource_mgt *net_resource_mgt; bad535d287c9c1 Bennie Yan 2024-09-24 297 struct nbl_serv_ring_mgt *ring_mgt; bad535d287c9c1 Bennie Yan 2024-09-24 298 struct nbl_dispatch_ops *disp_ops; bad535d287c9c1 Bennie Yan 2024-09-24 @299 struct net_device *netdev; bad535d287c9c1 Bennie Yan 2024-09-24 300 struct nbl_serv_ring_vsi_info *vsi_info; bad535d287c9c1 Bennie Yan 2024-09-24 301 u64 last_tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 302 u64 last_rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 303 u64 last_get_stats_jiffies, time_diff; bad535d287c9c1 Bennie Yan 2024-09-24 304 u64 tx_packets, rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 305 u64 tx_rates, rx_rates, pkt_rates; bad535d287c9c1 Bennie Yan 2024-09-24 306 u16 local_vector_id, vector_num; bad535d287c9c1 Bennie Yan 2024-09-24 307 u16 intr_suppress_level; bad535d287c9c1 Bennie Yan 2024-09-24 308 bad535d287c9c1 Bennie Yan 2024-09-24 309 net_resource_mgt = NBL_SERV_MGT_TO_NET_RES_MGT(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 310 netdev = net_resource_mgt->netdev; bad535d287c9c1 Bennie Yan 2024-09-24 311 ring_mgt = NBL_SERV_MGT_TO_RING_MGT(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 312 disp_ops = NBL_SERV_MGT_TO_DISP_OPS(serv_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 313 vsi_info = &ring_mgt->vsi_info[NBL_VSI_DATA]; bad535d287c9c1 Bennie Yan 2024-09-24 314 bad535d287c9c1 Bennie Yan 2024-09-24 315 last_tx_packets = net_resource_mgt->stats.tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 316 last_rx_packets = net_resource_mgt->stats.rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 317 last_get_stats_jiffies = net_resource_mgt->get_stats_jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 318 disp_ops->get_net_stats(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), &net_resource_mgt->stats); bad535d287c9c1 Bennie Yan 2024-09-24 319 /* ethtool -S don't adaptive interrupt suppression param */ bad535d287c9c1 Bennie Yan 2024-09-24 320 if (!vsi_info->itr_dynamic || ethtool) bad535d287c9c1 Bennie Yan 2024-09-24 321 return; bad535d287c9c1 Bennie Yan 2024-09-24 322 bad535d287c9c1 Bennie Yan 2024-09-24 323 tx_packets = net_resource_mgt->stats.tx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 324 rx_packets = net_resource_mgt->stats.rx_packets; bad535d287c9c1 Bennie Yan 2024-09-24 325 time_diff = jiffies - last_get_stats_jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 326 bad535d287c9c1 Bennie Yan 2024-09-24 327 net_resource_mgt->get_stats_jiffies = jiffies; bad535d287c9c1 Bennie Yan 2024-09-24 328 tx_rates = (tx_packets - last_tx_packets) / time_diff * HZ; bad535d287c9c1 Bennie Yan 2024-09-24 329 rx_rates = (rx_packets - last_rx_packets) / time_diff * HZ; bad535d287c9c1 Bennie Yan 2024-09-24 330 pkt_rates = max_t(u64, tx_rates, rx_rates); bad535d287c9c1 Bennie Yan 2024-09-24 331 bad535d287c9c1 Bennie Yan 2024-09-24 332 intr_suppress_level = bad535d287c9c1 Bennie Yan 2024-09-24 333 disp_ops->get_intr_suppress_level(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), pkt_rates, bad535d287c9c1 Bennie Yan 2024-09-24 334 ring_mgt->vectors->intr_suppress_level); bad535d287c9c1 Bennie Yan 2024-09-24 335 if (intr_suppress_level != ring_mgt->vectors->intr_suppress_level) { bad535d287c9c1 Bennie Yan 2024-09-24 336 local_vector_id = ring_mgt->vectors[vsi_info->ring_offset].local_vector_id; bad535d287c9c1 Bennie Yan 2024-09-24 337 vector_num = vsi_info->ring_num; bad535d287c9c1 Bennie Yan 2024-09-24 338 disp_ops->set_intr_suppress_level(NBL_SERV_MGT_TO_DISP_PRIV(serv_mgt), bad535d287c9c1 Bennie Yan 2024-09-24 339 local_vector_id, vector_num, bad535d287c9c1 Bennie Yan 2024-09-24 340 intr_suppress_level); bad535d287c9c1 Bennie Yan 2024-09-24 341 ring_mgt->vectors->intr_suppress_level = intr_suppress_level; bad535d287c9c1 Bennie Yan 2024-09-24 342 } bad535d287c9c1 Bennie Yan 2024-09-24 343 } bad535d287c9c1 Bennie Yan 2024-09-24 344 :::::: The code at line 299 was first introduced by commit :::::: bad535d287c9c1056d99de3666be7da84de4a8fc Net:nbl_core: Add nbl_core-driver for nebula-matrix S1055AS series smart NIC. :::::: TO: Bennie Yan <bennie.yan(a)nebula-matrix.com> :::::: CC: Bennie Yan <bennie.yan(a)nebula-matrix.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] [Backport] vhost-scsi: protect vq->log_used with vq->mutex
by ZHENG Xinyu 26 Jun '25

26 Jun '25

From: Dongli Zhang <dongli.zhang(a)oracle.com> stable inclusion from stable-v6.6.93 commit ca85c2d0db5f8309832be45858b960d933c2131c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAEC CVE: CVE-2025-38074 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] The vhost-scsi completion path may access vq->log_base when vq->log_used is already set to false. vhost-thread QEMU-thread vhost_scsi_complete_cmd_work() -> vhost_add_used() -> vhost_add_used_n() if (unlikely(vq->log_used)) QEMU disables vq->log_used via VHOST_SET_VRING_ADDR. mutex_lock(&vq->mutex); vq->log_used = false now! mutex_unlock(&vq->mutex); QEMU gfree(vq->log_base) log_used() -> log_write(vq->log_base) Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be reclaimed via gfree(). As a result, this causes invalid memory writes to QEMU userspace. The control queue path has the same issue. Signed-off-by: Dongli Zhang <dongli.zhang(a)oracle.com> Acked-by: Jason Wang <jasowang(a)redhat.com> Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Message-Id: <20250403063028.16045-2-dongli.zhang(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [Since this fix just want to protect vhost_add_used function from conccurent situation.] [And vhost_scsi_virtqueue data structure is different so we cannot get the virt queue from vhost_work.] [In this version, get the virt queue from cmd and solve the conccurent situation.] Signed-off-by: Zheng Xinyu <zhengxinyu6(a)huawei.com> --- drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index f896c8a83f1a..c16af38a3bbc 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter); if (likely(ret == sizeof(v_rsp))) { struct vhost_scsi_virtqueue *q; - vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq); + mutex_lock(&q->vq.mutex); + vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0); + mutex_unlock(&q->vq.mutex); vq = q - vs->vqs; __set_bit(vq, signal); } else @@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work) else resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED; + mutex_lock(&tmf->svq->vq.mutex); vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs, tmf->vq_desc, &tmf->resp_iov, resp_code); + mutex_unlock(&tmf->svq->vq.mutex); + vhost_scsi_release_tmf_res(tmf); } -- 2.34.1

1 0